tokamak-vault-breach

Participate in the Tokamak Network Vault Breach Challenge - an AI security Capture The Flag (CTF) game where you interact with a secured AI agent to extract...

This skill is an instruction-playbook for actively trying to extract secrets from a remote AI agent. That makes it high-risk even though it has no install or credential requests. Before installing or using it: 1) Confirm you have explicit authorization to test the listed URL/target (unauthorized access may be illegal). 2) Do not provide your own credentials or private keys to the skill or the remote dashboard. 3) Prefer to run any interactions in an isolated/sandboxed environment and avoid enabling autonomous, unsupervised runs. 4) Verify the dashboard URL and community links independently (they could be malicious or phishing). 5) If you cannot verify the source/owner or the legality of the challenge, do not proceed — treat this as potentially abusive guidance rather than a benign utility.

Type: OpenClaw Skill Name: tokamak-vault-breach Version: 1.0.0 The skill is designed for an AI security Capture The Flag (CTF) challenge, instructing the OpenClaw agent to interact with an external, untrusted server at `https://tokamak-network-openfang-vault-production.up.railway.app/` (as seen in SKILL.md). It directs the agent to make external network calls using `curl` and process responses via shell commands like `jq`. While the stated intent is educational, the execution of shell commands with data fetched from an external domain introduces a vulnerability risk (e.g., potential RCE if the external server is compromised or malicious and returns crafted data that exploits `jq` or shell parsing), classifying it as suspicious rather than benign. The instructions for 'prompt injection' and 'file system access' are directed at the *target AI agent* on the CTF platform, not the OpenClaw agent itself.